The Linkielist

Linking ideas with the world

The Linkielist

Someone got so fed up with GE fridge DRM – yes, fridge DRM – they made a whole website on how to bypass it

Posted on by

Fed up with the DRM in a General Electric refrigerator that pushed the owner to buy expensive manufacturer-approved replacement water filters, an anonymous hacker went to the trouble of buying a domain name and setting up a website at gefiltergate.com to pen a screed about appliance digital rights restriction management (DRM) and how to bypass it.

The fridge in question required a GE RPWFE refrigerator water filter. It has an RFID chip, which the fridge uses to verify the authenticity of the part. The RPWFE filter costs much more than unapproved filters: about $50 compared to $13.

“Some ******* at GE thought it would be a good idea to include a ******* RFID DRM module in select refrigerators,” the unidentified individual wrote, without using the asterisks we’ve included because online profanity filters are awful.

The Register contacted GE to ask about this, and the American giant’s corporate communications director promptly replied that GE sold its appliance unit to China-based Haier in 2016, which continues to use its brand. Haier did not immediately respond to our inquiry.

The gefiltergate.com website, borrowing from a similar post on another website back in May, explains how to hack your Haier GE-brand fridge by affixing an RFID tag – stripped from a component for bypassing the water filter system – to the RFID sensor.

The GE website suggests that a water filter is a good idea to avoid exposure to unfiltered water and sediment, inadvertently offering a sad commentary on public water infrastructure and government funding priorities. It recommends its RFID water filter because the chip chats with the fridge to report leaks, and will shut off the water supply if a leak is detected.

But the appliance doesn’t require the RFID filter; fridge owners can use the bypass plug, and still get unfiltered water.

“Non-GE filters and counterfeit filters without this technology will not perform the same way in the event of a water leak,” the company’s website explains. “The refrigerator has the option to use a bypass plug should you not want to use a genuine GE Appliances water filter.”

That makes it sound as if fridge owners can use water filters from another vendor but that’s not the case – the bypass plug is just to silence the fridge display screen warnings coming from the filtration system’s RFID sensor. “The ID chip on the filter detects when a wrong or non-genuine GE Appliance part is used,” the GE Appliances website states. “If this happens, the dispenser will not work and the display may read ‘Leak Detected.'”

Hence the need to hack the fridge, which is something product owners evidently have been doing for years. The Amazon.com webpage for the bypass plug contains a string of user reviews indicating that customers only purchased the thing for its RFID chip. And complaints abound on discussion site Reddit.

In a phone interview with The Register, Gay Gordon-Byrne, executive director of The Repair Association, said product hacking of this sort is entirely legal, in America at least. The US Copyright Office, she said, included software-enabled appliance repair in its 2018 rulemaking [PDF], and patents are not an issue in this case. And the Magnuson-Moss Warranty Act guarantees that consumers can use parts not from the original manufacturer.

Asked whether such practices generate enough ill-will to make them unprofitable, Gordon-Byrne said they can, pointing to Keurig’s problems selling coffee makers with digital locks, but added that people have to be aware of the problem.

“It generates some ill will but not enough to offset the value of controlling the whole parts market,” she said. “But it’s a stupid, stupid thing to do. There’s no reason to do this.”

Right-to-repair legislation, which aims to ensure consumers have a legal right to repair products where product makers or laws deny that possibility, was being considered in about 20 US states last year. However, Gordon-Byrne said that progress has stalled due to the coronavirus outbreak. She expects repair bills will have to be reintroduced in January next year.

Current US Copyright Office exemptions, she said, should be renewed for 2021 and she expects to lobby for new exemptions for product categories where repairs that require breaking digital locks are still not allowed, like boats, medical equipment, and game consoles.

Source: Someone got so fed up with GE fridge DRM – yes, fridge DRM – they made a whole website on how to bypass it • The Register

Trump Administration Eliminates Transgender Health Protections

Posted on by

In an utterly heartless move, the Trump administration on Friday eliminated health care protections for transgender people during an ongoing global pandemic that has claimed more lives in the U.S. than in any other country.

It did this by finalizing a rule under Section 1557 of the Affordable Care Act (ACA), which prohibits health programs or activities from discriminating on the basis of race, color, national origin, sex, age, or disability. The Trump administration rule—announced on the fourth anniversary of the Pulse nightclub shooting and in the middle of Pride month—changes the definition of sex discrimination, eliminating protections due to gender identity, and considers the word “sex” to refer to “male or female and as determined by biology.”

[…]

The nondiscrimination provisions were established by the Obama administration in 2016. That year, the Obama administration issued a rule to implement Section 1557 that redefined sex discrimination to include gender identity, which it defined as, “an individual’s internal sense of gender, which may be male, female, neither, or a combination of male and female, and which may be different from an individual’s sex assigned at birth.”

Under the new rule, a transgender person could be refused care for a checkup at a doctor’s office, according to NPR. Other possible scenarios include a transgender man being denied treatment for ovarian cancer, or a hysterectomy not being covered by an insurer. Some experts say that the rule opens the door for medical providers to refuse to test someone for covid-19, the disease caused by the novel coronavirus, simply because they’re transgender.

When it comes to health insurance and health care, transgender people are vulnerable to being treated negatively by their insurance and health care providers. According to the (old broken link: 2015 U.S. Transgender Survey) 2015 US Transgender Survey (new link) carried out by the National Center for Transgender Equality, transgender people have been denied coverage for care related to their gender transition, for routine care because they were transgender, or for transition-related surgery.

The survey found that 23 percent of respondents reported not going to see a doctor when they needed to because of fear of being mistreated as a transgender person. Of those who did go see a healthcare provider, 33 percent reported that they had had at least one negative experience related to being transgender, such as being refused treatment, verbally harassed, or physically or sexually assaulted, among other horrible experiences.

Source: Trump Administration Eliminates Transgender Health Protections

So Trump is following in the illustrious footsteps of Hungary, whos president immediately used the emergency dictatorial powers bestowed upon him due to Covid to changes the “sex” category in official documents like birth certificates to “sex at birth,” which can never be changed.

Source: Hungary bans legal recognition of its transgender citizens

Tanvas Haptic Touch Screen

Posted on by

With touch screens getting more and more prevalent, we’re seeing more experimentation with haptics. Being able to feel something other than just the smooth glass surface can be incredibly advantageous. Have you been in a car with a touch screen radio system? If so you’ll know the frustration.

Tanvas is a system that adds haptics by changing the amount of adhesion your finger tip experiences on the screen. Basically, they’re increasing the friction in a controlled manner. The result is a distinct difference between various areas of the screen. To be clear, you’re not feeling ridges, edges, or other 3 dimensional items, but you can definitely feel where something exists and something does not.

The touch screen itself isn’t really a consumer product. This is a dev kit, so you could incorporate their tech into your projects. Admittedly, this is only appealing to a very narrow subset of our readership (those developing a product that uses a touch screen) but I felt the tech was very interesting and wanted to share. Personally, I’d love to see this technology employed in popular consumer devices such as iPads!

Source: Quick Look: Tanvas Haptic Touch Screen

Keepnet fires legal threats at bloggers for exposing their 876GB unsecured database with years of leaked credentials, backfires

Posted on by

UK-based infosec outfit Keepnet Labs left an 867GB database of previously compromised website login details accessible to world+dog earlier this year – then sent lawyers’ letters to bloggers in a bid to erase their reports of its blunder.

A contractor left the Keepnet Elasticsearch database unsecured back in March after disabling a firewall, exposing around five billion harvested records to the public internet, the firm admitted in a statement yesterday.

The database was indexed by a search engine, and came to the attention of noted infosec blogger Volodymyr “Bob” Diachenko, who wrote it all up. Keepnet disputed Diachenko’s initial characterisation of the breach, and things spiralled from there.

As reported by news website Verdict, Keepnet was stung by Diachenko’s initial post about the gaffe, which Keepnet interpreted as the blogger blaming the business for leaking its own customers’ data – none of its own clients’ data was exposed, but rather info from previous publicly known database exposures. Diachenko said the database contained email addresses, hashed passwords, the sources of the information, and other details, all gathered from previous leaks by hackers.

What actually happened, Keepnet later insisted, was that a contractor had screwed up by turning off a firewall. The 867GB database, claimed Keepnet, contained email addresses harvested from other data spillages that took place between 2013 and 2019.

“As part of the Keepnet Labs Solution, we provide a ‘compromised email credentials’ threat intelligence service. To provide this service, we are continuously collecting publicly known data-breach data from online public resources. We then store this data in our own secure Elasticsearch database and provide companies with the information relating to their business email domains via our Keepnet platform,” the firm insisted.

Nonetheless, Keepnet responded to the bloggerati by sending lawyers’ letters to all and sundry, demanding its name be removed from the posts about the prone Elasticsearch database. Unfortunately for Keepnet, one of those letters landed on the doormat of veteran infosec scribbler Graham Cluley. Not one to be cowed, Cluley removed the firm’s name from his blog post – then tweeted about it.

In a subsequent post about the kerfuffle, Cluley said: “I gave Keepnet Labs multiple opportunities to tell me what was incorrect in my article, or to offer me a public statement that I could include in the article. I told them I was keen to present the facts accurately.” This is best practice for bloggers and standard practice for reputable news organs.

El Reg has received its fair share of lawyers’ letters commissioned by red-faced company execs determined to disrupt and deter news reporting of their doings. The letter sent to Cluley (seen by The Register and screenshotted at the link just above) seemingly complained that Cluley had defamed the company. It called out words that weren’t actually in his blog post; cited part of an EU directive that has nothing to do with defamation law either in the political bloc or in the UK as justification; and threatened legal action, injunctions, costs and damages (£££) unless the entire blog post was deleted.

Whether the Elasticsearch database truly was exposed for just 10 minutes as Keepnet claimed, and whether those 10 minutes were long enough for it to be indexed, that index to be seeded through BinaryEdge, Diachenko to notice the new result, click around as required, download 2MB of it, inspect the download and then figure out who owned the database, is all moot. Keepnet’s actions after the discovery eclipsed the original screw-up completely.

An unrepentant Keepnet said in its statement: “We have been working over the past few months to get in contact with the authors of posts who have shared inaccurate aspects of this story and have politely asked them to update their articles,” which is a funny way of saying “hired a lawyer to threaten a defamation lawsuit unless the posts were deleted.” This was only ever going to produce one result, and not the one Keepnet wanted.

As Cluley put it: “Security firms should be examples for all businesses on how to behave after a security breach. Transparency, disclosure of what went wrong, and what steps are being taken to ensure that something similar doesn’t happen again are key to building trust and confidence from customers and the rest of the industry.”

For what it’s worth, El Reg didn’t cover the breach at the time it was first reported because, well, it involved public information becoming public again. It is to be hoped that Keepnet’s entirely self-inflicted reputational harm here teaches its founder a sharp and valuable lesson.

Keepnet did not respond last week when we asked the firm for comment.

Source: Keepnet kerfuffle: Firing legal threats at bloggers did infosec biz more damage than its exposed database • The Register

Planet’s SkySats zoom in for a closer look at the Earth, get 50cm per pixel granularity

Posted on by

The remote-sensing firm Planet operates more than one hundred satellites that constantly orbit the earth, collecting imagery of the world’s entire landmass each day. Now, to offer more clarity to its customers, it has flown a handful of its satellites 50 km closer to the Earth.

This literal zoom-in effort will allow the firm to offer imagery with a resolution of 50 cm of earth per pixel, an increase from 80 cm. In one example, that means that as well as seeing the shape of a car, analysts will also be able to clearly discern the position of its windshield.

By the end of the summer, the company plans to add six new satellites to its constellation, allowing it to take those higher resolution pictures of the same area twelve times a day.

“We felt like 50 centimeters was an important threshold, but where we are really pushing the envelope is on that revisit,” Jim Thomason, a Planet vice president, told Quartz.

The ability to view the same area repeatedly means customers will get their imagery sooner after they request it, and they may be able to see what is changing on the ground. That also means a higher chance of dodging the bane of optical space imagery: clouds.

Planet
A “before” image.
An “after” image. “Orthorectified” refers to the process where sensor data taken of uneven terrain is accurately mapped onto a flat image.

Planet was founded in 2010 by former NASA scientists who wanted to leverage new advances in satellite technology and expand access to space data. Its customers include US intelligence agencies, the NGOs that second-guess them, agricultural conglomerates, and firms that use machine learning to gain insight from remote-sensing data.

Planet operates more than 150 satellites, most of which are Doves, toaster-oven sized craft that collectively “scan” the earth each day, producing imagery with a resolution about three meters per pixel. You may have seen the company’s widely-shared image of a new mural in Washington, D.C.

Source: Planet’s SkySats zoom in for a closer look at the Earth — Quartz

Obscure Indian cyber firm spied on politicians, investors worldwide

Posted on by

New Delhi-based BellTroX InfoTech Services targeted government officials in Europe, gambling tycoons in the Bahamas, and well-known investors in the United States including private equity giant KKR and short seller Muddy Waters, according to three former employees, outside researchers, and a trail of online evidence.

Aspects of BellTroX’s hacking spree aimed at American targets are currently under investigation by U.S. law enforcement, five people familiar with the matter told Reuters. The U.S. Department of Justice declined to comment.

Reuters does not know the identity of BellTroX’s clients. In a telephone interview, the company’s owner, Sumit Gupta, declined to disclose who had hired him and denied any wrongdoing.

Muddy Waters founder Carson Block said he was “disappointed, but not surprised, to learn that we were likely targeted for hacking by a client of BellTroX.” KKR declined to comment.

Researchers at internet watchdog group Citizen Lab, who spent more than two years mapping out the infrastructure used by the hackers, released a report here on Tuesday saying they had “high confidence” that BellTroX employees were behind the espionage campaign.

“This is one of the largest spy-for-hire operations ever exposed,” said Citizen Lab researcher John Scott-Railton.

Although they receive a fraction of the attention devoted to state-sponsored espionage groups or headline-grabbing heists, “cyber mercenary” services are widely used, he said. “Our investigation found that no sector is immune.”

A cache of data reviewed by Reuters provides insight into the operation, detailing tens of thousands of malicious messages designed to trick victims into giving up their passwords that were sent by BellTroX between 2013 and 2020. The data was supplied on condition of anonymity by online service providers used by the hackers after Reuters alerted the firms to unusual patterns of activity on their platforms.

The data is effectively a digital hit list showing who was targeted and when. Reuters validated the data by checking it against emails received by the targets.

On the list: judges in South Africa, politicians in Mexico, lawyers in France and environmental groups in the United States. These dozens of people, among the thousands targeted by BellTroX, did not respond to messages or declined comment.

Reuters was not able to establish how many of the hacking attempts were successful.

BellTroX’s Gupta was charged in a 2015 hacking case in which two U.S. private investigators admitted to paying him to hack the accounts of marketing executives. Gupta was declared a fugitive in 2017, although the U.S. Justice Department declined to comment on the current status of the case or whether an extradition request had been issued.

Speaking by phone from his home in New Delhi, Gupta denied hacking and said he had never been contacted by law enforcement. He said he had only ever helped private investigators download messages from email inboxes after they provided him with login details.

Source: Exclusive: Obscure Indian cyber firm spied on politicians, investors worldwide – Reuters

Hospital-busting hacker crew may be behind ransomware attack that made Honda halt car factories, say researchers

Posted on by

Japanese car maker Honda has been hit by ransomware that disrupted its production of vehicles and also affected internal communications, according to reports.

The ransomware, of an as-yet unidentified strain, appeared to have spread through the multinational firm’s network. A Honda spokesman told the media it appeared to have “hit the company’s internal servers.”

Some Honda factories around the world were forced to suspend production, though output from Turkey, India, USA and Brazil locations remain on hold at the time of writing.

Sky News reported yesterday that Honda’s networks began to suffer “issues” on Monday, and that “the company believed it was the result of unauthorised attempts to breach its systems.”

A Honda spokesbeing told several outlets: “We can confirm some impact in Europe and are currently investigating the exact nature.”

Another statement from the firm today added: “Work is being undertaken to minimise the impact and to restore full functionality of production, sales and development activities.”

In the meantime, multiple researchers have suggested the culprit was Ekans, with one Milkr3am, posting screenshots on Twitter of a sample submitted to VirusTotal today that checks for the internal Honda network name of “mds.honda.com”.

Professor Alan Woodward of the University of Surrey told El Reg: “With a just-in-time system you need only a small outage in IT to cause a problem. As it happens I think Honda have recovered quite quickly. A few countries’ facilities are still affected but they seem to be coming back very fast, which suggests they had a good response plan in place.”

The speed at which the malware spread in Honda’s network indicates that some the company has centralised functions, “the usual culprits are finance,” he added.

Source: Hospital-busting hacker crew may be behind ransomware attack that made Honda halt car factories, say researchers • The Register

WhatsApp was exposing users’ phone numbers in Google search

Posted on by

WhatsApp claims it fixed an issue that was showing users’ phone numbers in Google search results, TechCrunch reports. The change comes after security researcher Athul Jayaram revealed that phone numbers of WhatsApp users who used the Click to Chat feature were being indexed in search.

Click to Chat allows users to create a link with their phone number in plain text. According to Jayaram, because the links don’t have a robot.txt file in the server root, they cannot stop Google or other search engine bots from crawling and indexing the links. Jayaram says as many as 300,000 phone numbers may have appeared in Google search results, and they could be found by searching “site:wa.me.”

As TechCrunch notes, Jayaram isn’t the first to report this issue. WaBetaInfo pointed it out in February. While the issue seems to be fixed, it’s a pretty big security flaw and apparently it’s been a problem for at least several months.

Source: WhatsApp was exposing users’ phone numbers in Google search | Engadget

From off-prem to just off: IBM Cloud goes down planet-wide so hard even the status page didn’t work – and outside of US business hours

Posted on by

IBM’s cloud has gone down hard across the world.

We’d love to tell you just how hard the service has hit the dirt, but even the Big Blue status page is intermittently unavailable:

IBM cloud outage June 10 2020

IBM Cloud status page … Click to enlarge

Your humble hack has an IBM Cloud account, and when attempting to login in the hope that a customer-facing page could offer some information, he saw only the following error message:

IBM cloud outage login

Click to enlarge

IBM’s social feeds are silent on the outage at the time of writing.

One Australian IBM Cloud user told us that the outage has run for at least two hours, and means he is unable to deliver business services that customers depend on as they start their days. The breakdown is said to be global.

Clients are mad as hell because the blunder appears to have hit after business hours on the east coast of America, and IBM has not been responsive.

The Register has asked IBM to explain the outage, and we will update this story if and when more information becomes available. ®

Updated to add at 0020 UTC on June 10

The user we spoke to earlier tells us that their IBM-hosted services have come back to life. However, the IBM Cloud status page is still not working, and when this vulture tried to view it or to log on, this appeared…

IBM cloud outage continues

Your cloud is important to us. If you’d like to know more, press refresh for an hour or more.

Final update at 0140 UTC on June 10

The IBM Cloud’s status page is live again, and users can log in once more.

The status page lists fifteen active events though offers almost no detail other than the admission that: “Technical teams are engaged and have identified a broad network incident that is impacting many cloud services.” That information appears in a notification titled “Watson Platform users are unable to access console or applications in all regions.”

Source: From off-prem to just off: IBM Cloud goes down planet-wide so hard even the status page didn’t work • The Register

Dutch Justice minister wants to put webhosters that won’t do what he wants on a shaminglist, unburdened by proof and using kiddie porn as an excuse

Posted on by

The stance seems to be: If minister Grapperhaus tells a webhost to remove content, they should do it without the court system intervening.

As soon as they invoke kiddie porn you know that something totalitarian is being justified. Because once that is allowed, then they expand the powers to all content. And noboday can be seen to be against fighting kiddie porn, right?

Source: Foute en lakse webhosters gaan per september op een zwarte lijst – Emerce

Space Force Losing Trademark Battle With Netflix’s Space Force

Posted on by

The real Space Force may be going down in flames against the fictional Space Force: According to the Hollywood Reporter, the newly founded military branch appears to be losing a trademark battle with the Netflix comedy show of the same name.

Netflix “has outmaneuvered the U.S. government to secure trademark rights to ‘Space Force’ in Europe, Australia, Mexico and elsewhere,” according to the Reporter, while the Air Force—under which the Space Force is organized—simply has a pending application stateside. This mostly has ramifications for merch. Consumers won’t have trouble discerning between the military branch and Space Force when it comes to which one stars Steve Carrell, but they might not be able who is selling a line of Space Force shirts.

The U.S. Patent and Trademark Office relies on a “first-to-use” system when assigning rights, and Netflix has been submitting trademark applications for the Space Force across the globe since the start of 2019. On the other hand, the Air Force filed a trademark application on the basis of intent to use in March 2019, per Law & Crime, and the Space Force didn’t become an actual organization until December 2019. If it comes down to a legal battle, that means Netflix may be able to easily demonstrate it was actually using the Space Force branding first. (Even if Netflix lost the case, it would have a First Amendment right to continue selling Space Force merch on the grounds of satire and parody.)

Source: Space Force Losing Trademark Battle With Netflix’s Space Force

OK, so not only is this silly but the fact that you can apparently actually trademark two words in a row seems absolutely bonkers to me.

deepart.io turns your picture into versions of existing art pictures

Posted on by

Artificial intelligence turning your photos into art

It uses the stylistic elements of one image to draw the content of another. Get your own artwork in just three steps.

  1. Upload photo

    The first picture defines the scene you would like to have painted.

  2. Choose style

    Choose among predefined styles or upload your own style image.

  3. Submit

    Our servers paint the image for you. You get an email when it’s done.

Source: deepart.io – become a digital artist

Bug bounty platforms buy researcher silence, violate labor laws, critics say

Posted on by

Used properly, bug bounty platforms connect security researchers with organizations wanting extra scrutiny. In exchange for reporting a security flaw, the researcher receives payment (a bounty) as a thank you for doing the right thing. However, CSO’s investigation shows that the bug bounty platforms have turned bug reporting and disclosure on its head, what multiple expert sources, including HackerOne’s former chief policy officer, Katie Moussouris, call a “perversion.”

Bug bounty vs. VDP

A vulnerability disclosure program (VDP) is a welcome mat for concerned citizens to report security vulnerabilities. Every organization should have a VDP. In fact, the US Federal Trade Commission (FTC) considers a VDP a best practice, and has fined companies for poor security practices, including failing to deploy a VDP as part of their security due diligence. The US Department of Homeland Security (DHS) issued a draft order in 2019 mandating all federal civilian agencies deploy a VDP.

Regulators often view deploying a VDP as minimal due diligence, but running a VDP is a pain. A VDP looks like this: Good-faith security researchers tell you your stuff is broken, give you 90 days max to fix it, and when the time is up they call their favorite journalist and publish the complete details on Twitter, plus a talk at Black Hat or DEF CON if it’s a really juicy bug.

[…]

“Bug bounties are best when transparent and open. The more you try to close them down and place NDAs on them, the less effective they are, the more they become about marketing rather than security,” Robert Graham of Errata Security tells CSO.

Leitschuh, the Zoom bug finder, agrees. “This is part of the problem with the bug bounty platforms as they are right now. They aren’t holding companies to a 90-day disclosure deadline,” he says. “A lot of these programs are structured on this idea of non-disclosure. What I end up feeling like is that they are trying to buy researcher silence.”

The bug bounty platforms’ NDAs prohibit even mentioning the existence of a private bug bounty. Tweeting something like “Company X has a private bounty program over at Bugcrowd” would be enough to get a hacker kicked off their platform.

The carrot for researcher silence is the money — bounties can range from a few hundred to tens of thousands of dollars — but the stick to enforce silence is “safe harbor,” an organization’s public promise not to sue or criminally prosecute a security researcher attempting to report a bug in good faith.

The US Department of Justice (DOJ) published guidelines in 2017 on how to make a promise of safe harbor. Severe penalties for illegal hacking should not apply to a concerned citizen trying to do the right thing, they reasoned.

Want safe harbor? Sign this NDA

Sign this NDA to report a security issue or we reserve the right to prosecute you under the Computer Fraud and Abuse Act (CFAA) and put you in jail for a decade or more. That’s the message some organizations are sending with their private bug bounty programs.

[…]

The PayPal terms, published and facilitated by HackerOne, turn the idea of a VDP with safe harbor on its head. The company “commits that, if we conclude, in our sole discretion, [emphasis ours] that a disclosure respects and meets all the guidelines of these Program Terms and the PayPal Agreements, PayPal will not bring a private action against you or refer a matter for public inquiry.”

The only way to meet their “sole discretion” decision of safe harbor is if you agree to their NDA. “By providing a Submission or agreeing to the Program Terms, you agree that you may not publicly disclose your findings or the contents of your Submission to any third parties in any way without PayPal’s prior written approval.”

HackerOne underscores that safe harbor can be contingent on agreeing to program terms, including signing an NDA, in their disclosure guidelines. Bug finders who don’t wish to sign an NDA to report a security flaw may contact the affected organization directly, but without safe harbor protections.

“Submit directly to the Security Team outside of the Program,” they write. “In this situation, Finders are advised to exercise good judgement as any safe harbor afforded by the Program Policy may not be available.”

[…]

security researchers concerned about safe harbor protection should not rest easy with most safe harbor language, Electronic Frontier Foundation (EFF) Senior Staff Attorney Andrew Crocker tells CSO. “The terms of many bug bounty programs are often written to give the company leeway to determine ‘in its sole discretion’ whether a researcher has met the criteria for a safe harbor,” Crocker says. “That obviously limits how much comfort researchers can take from the offer of a safe harbor.”

“EFF strongly believes that security researchers have a First Amendment right to report their research and that disclosure of vulnerabilities is highly beneficial,” Crocker adds. In fact, many top security researchers refuse to participate on bug bounty platforms because of required NDAs.

[…]

Health insurance in the US is typically provided by employers to employees, and not to independent contractors. However, legal experts tell CSO that the bug bounty platforms violate both California and US federal labor law.

California AB 5, the Golden State’s new law to protect “gig economy” workers that came into effect in January 2020, clearly applies to bug bounty hunters working for HackerOne, Bugcrowd and Synack, Leanna Katz, an LLM candidate at Harvard Law School researching legal tests that distinguish between independent contractors and employees, tells CSO.

[…]

“My legal analysis suggests those workers [on bug bounty platforms] should at least be getting minimum wage, overtime compensation, and unemployment insurance,” Dubal tells CSO. “That is so exploitative and illegal,” she adds, saying that “under federal law it is conceivable that not just HackerOne but the client is a joint employer [of bug finders]. There might be liability for companies that use [bug bounty platform] services.”

“Finders are not employees,” Rice says, a sentiment echoed by Bugcrowd founder Ellis and Synack founder Jay Kaplan. Synack’s response is representative of all three platforms: “Like many companies in California, we’re closely monitoring how the state will apply AB 5, but we have a limited number of security researchers based in California and they represent only a fractional percentage of overall testing time,” a Synack representative tells CSO.

Using gig economy platform workers to discover and report security flaws may also have serious GDPR consequences when a security researcher discovers a data breach.

Bug bounty platforms may violate GDPR

When is a data breach not a data breach?

When a penetration testing consultancy with vetted employees discover the exposed data.

A standard penetrating testing engagement contract includes language that protects the penetration testers — in short, it’s not a crime if someone asks you to break into their building or corporate network on purpose, and signs a contract indemnifying you.

This includes data breaches discovered by penetration testers. Since the pen testers are brought under the umbrella of the client, say “Company X,” any publicly exposed Company X data discovered is not considered publicly exposed, since that would legally be the same as a Company X employee discovering a data breach, and GDPR’s data breach notification rules don’t come into play.

What about unvetted bug bounty hunters who discover a data breach as part of a bug bounty program? According to Joan Antokol, a GDPR expert, the EU’s data breach notification regulation applies to bug bounty platforms. Antokol is partner at Park Legal LLC and a longstanding member of the International Working Group on Data Protection in Technology (IWGDPT), which is chaired by the Berlin Data Protection Commissioner. She works closely with GDPR regulators.

“If a free agent hacker who signed up for a project via bug bounty companies to try to find vulnerabilities in the electronic systems of a bug bounty client (often a multinational company), was, in fact, able to access company personal data of the multinational via successful hacking into their systems,” she tells CSO, “the multinational (data controller) would have a breach notification obligation under the GDPR and similar laws of other countries.”

[…]

ISO 29147 standardizes how to receive security bug reports from an outside reporter for the first time and how to disseminate security advisories to the public.

ISO 30111 documents internal digestion of bug reports and remediation within an affected software maker. ISO provided CSO with a review copy of both standards, and the language is unambiguous.

These standards make clear that private bug bounty NDAs are not ISO compliant. “When non-disclosure is a required term or condition of reporting bugs via a bug bounty platform, that fundamentally breaks the process of vulnerability disclosure as outlined in ISO 29147,” Moussouris says. “The purpose of the standard is to allow for incoming vulnerability reports and [her emphasis] release of guidance to affected parties.”

ISO 29147 lists four major goals, including “providing users with sufficient information to evaluate risk due to vulnerabilities,” and lists eight different reasons why publishing security advisories is a standardized requirement, including “informing public policy decisions” and “transparency and accountability.” Further, 29147 says that public disclosure makes us all more secure in the long term. “The theory supporting vulnerability disclosure holds that the short-term risk caused by public disclosure is outweighed by longer-term benefits from fixed vulnerabilities, better informed defenders, and systemic defensive improvements.”

Source: Bug bounty platforms buy researcher silence, violate labor laws, critics say | CSO Online

Smart fridges are cool, but after a few short years you could be stuck with a big frosty brick in the kitchen

Posted on by

A report from consumer advocates Which? highlights the shockingly short lifespan of “smart” appliances, with some losing software support after just a few years, despite costing vastly more than “dumb” alternatives.

That lifespan varies between manufacturers: Most vendors were vague, with Beko offering “up to 10 years” and LG saying patches would be issued as required. Samsung said it would offer software support for a maximum of two years, according to the report.

Only one manufacturer, Miele, promised to issue software updates for a full decade after the release of a device, but then Miele tends to make premium priced products.

[…]

For consumers, that ambiguous (if not outright short) lifespan raises the possibility they could be forced to replace their expensive white goods before they otherwise would. According to the consumer watchdog, fridge-freezers typically last 11 years.

If a manufacturer decides to withdraw software support, or switch off central servers, users could find themselves with a big, frosty brick in their kitchen. In the wider IoT world, there’s precedent for this.

In 2016, owners of the Revolv smart home hub were infuriated after the Google-owned Nest deactivated the servers required for it to work. More recently, Belkin flicked the kill switch on its WeMo NetCam IP cameras, offering refunds only to those users whose devices were still in warranty and had the foresight to keep their receipts.

There’s another cause for concern. Given that smart appliances are essentially computers with a persistent connection to the internet, there’s a risk hackers could co-opt unpatched fridges and dishwashers, turning them into drones in vast botnets.

Again, there’s precedent. The Mirai botnet, for example, was effectively composed of hacked routers and IP cameras.

Source: Smart fridges are cool, but after a few short years you could be stuck with a big frosty brick in the kitchen • The Register

Secure the software development lifecycle with machine learning

Posted on by

At Microsoft, 47,000 developers generate nearly 30 thousand bugs a month. These items get stored across over 100 AzureDevOps and GitHub repositories. To better label and prioritize bugs at that scale, we couldn’t just apply more people to the problem. However, large volumes of semi-curated data are perfect for machine learning. Since 2001 Microsoft has collected 13 million work items and bugs. We used that data to develop a process and machine learning model that correctly distinguishes between security and non-security bugs 99 percent of the time and accurately identifies the critical, high priority security bugs, 97 percent of the time. This is an overview of how we did it.

Source: Secure the software development lifecycle with machine learning – Microsoft Security

Belg opent lijnvlucht met private jets naar Ibiza

Posted on by

Voor 495 euro in een private jet naar Ibiza vliegen, met 25 kilogram bagage, luxesnacks en een glaasje champagne. Dat wil de Limburgse luchtvaartondernemer Philippe Bodson vanaf 4 juli onder de naam Flying Executive in de markt zetten. Op wekelijkse basis vanuit Brussel.

Een lijnvlucht voor private jets is geen primeur in Europa. Maar de timing is wel opvallend. Met dat concept roeit Bodson, de topman van ASL Group, naar eigen zeggen tegen de stroom in. ‘Het staat haaks op alle tendensen in de luchtvaartsector, die door low cost wordt gedreven. Maar het sluit perfect aan op de nieuwe noden van het postcoronareizen.’

Bodson, die op zijn 34ste een pilotenbrevet haalde en daarna van zijn hobby zijn beroep maakte door een eigen luchtvaartbedrijf op te richten, schakelt voor de nieuwe formule twee toestellen van het type Embraer in. Dat zijn vliegtuigen met een beperkt aantal zitplaatsen (respectievelijk 30 en 42) en meer beenruimte (plus 12 centimeter) dan op een gewone lijnvlucht.

De binnenruimte in die toestellen – met één zetel links en twee zetels rechts – biedt volgens hem ook een veel betere vluchtervaring. ‘Het voordeel is dat reizigers steeds alleen of naast een bekende kunnen zitten’, zegt hij. ‘In tijden van Covid-19 geeft dat een prettiger gevoel.’

Source: Belg opent lijnvlucht met private jets naar Ibiza | De Tijd

Guides for Visualizing Reality – and checking on the charts

Posted on by

We like to complain about how data is messy, not in the right format, and how parts don’t make sense. Reality is complicated though. Data comes from the realities. Here are several guides to help with visualizing these realities, which seem especially important these days.

Visualizing the Uncertainty in Data

For when you don’t know what is going to happen.

Visualizing Incomplete and Missing Data

We love complete and nicely formatted data. That’s not what we get a lot of the time.

Visualizing Outliers

Step 1: Figure out why the outlier exists in the first place. Step 2: Choose from these visualization options to show the outlier.

Visualizing Differences

Focus on finding or displaying contrasting points, and some visual methods are more helpful than others.

Visualizing Patterns on Repeat

Things have a way of repeating themselves, and it can be useful to highlight these patterns in data.

One Dataset, Visualized 25 Ways

A single dataset can tell you a lot of things. See also how questions can guide you.

How to Spot Visualization Lies

Chart ≠ fact.

Source: Guides for Visualizing Reality | FlowingData

Astronomers have found a planet like Earth orbiting a star like the sun

Posted on by

Three thousand light-years from Earth sits Kepler 160, a sun-like star that’s already thought to have three planets in its system. Now researchers think they’ve found a fourth. Planet KOI-456.04, as it’s called, appears similar to Earth in size and orbit, raising new hopes we’ve found perhaps the best candidate yet for a habitable exoplanet that resembles our home world. The new findings bolster the case for devoting more time to looking for planets orbiting stars like Kepler-160 and our sun, where there’s a better chance a planet can receive the kind of illumination that’s amenable to life.

Most exoplanet discoveries so far have been made around red dwarf stars. This isn’t totally unexpected; red dwarfs are the most common type of star out there. And our main method for finding exoplanets involves looking for stellar transits—periodic dips in a star’s brightness as an orbiting object passes in front of it. This is much easier to do for dimmer stars like red dwarfs, which are smaller than our sun and emit more of their energy as infrared radiation

[…]

Data on the new exoplanet orbiting Kepler 160, published in Astronomy and Astrophysics on Thursday, points to a different situation entirely. From what researchers can tell, KOI 456.04 looks to be less than twice the size of Earth and is apparently orbiting Kepler-160 at about the same distance from Earth to the sun (one complete orbit is 378 days). Perhaps most important, it receives about 93% as much light as Earth gets from the sun.

This is critical, because one of the biggest obstacles to habitability around red dwarf stars is they can emit a lot of high-energy flares and radiation that could fry a planet and any life on it. By contrast, stars like the sun—and Kepler-160, in theory—are more stable and suitable for the evolution of life.

[…]

Right now the researchers say it’s 85% probable KOI-456.04 is an actual planet. But it could still be an artifact of Kepler’s instruments or the new analysis—an object needs to pass a threshold of 99% to be a certified exoplanet. Getting that level of certainty will require direct observations. The instruments on NASA’s upcoming James Webb Space Telescope are expected to be up to the task, as are those on ESA’s PLATO space telescope, due to launch in 2026.

Source: Astronomers have found a planet like Earth orbiting a star like the sun | MIT Technology Review

Brave Browser Mistake Adds Its Referrer Code For Cryptocurrency Sites – quite a big oops also for privacy

Posted on by

The following report appeared on Yahoo! Finance: Privacy-focused browser Brave was found to autocomplete several websites and keywords in its address bar with an affiliate code. Shortly after a user published his findings, Brave CEO and co-founder Brendan Eich addressed the incident and called it “a mistake we’re correcting.” Eich said that while Brave is a Binance affiliate [a cryptocurrency exchange], the browser’s autocompleting feature should not have added any new affiliate codes.

“The autocomplete default was inspired by search query clientid attribution that all browsers do, but unlike keyword queries, a typed-in URL should go to the domain named, without any additions,” Eich wrote in the thread. “Sorry for this mistake — we are clearly not perfect, but we correct course quickly,” he added.
Android Police reports the mistake occured more than 10 weeks ago — and that referrer codes were also included for other cryptocurrency-related sites: The browser’s GitHub repository reveals the functionality was first added on March 25th, and the current list of sites includes Binance, Coinbase, Ledger, and Trezor. Brave Software receives a kickback for purchases/accounts made with those services — for example, Coinbase says that when you refer a new customer to the service, you can earn 50% of their fees for the first three months.

The nature of these affiliate programs also allows the referrer — in this case, Brave Software — to view some amount of data about the customers who sign up with the code. Coinbase’s program provides “direct access to your campaign’s performance data,” while Trezor offers a “detailed overview of purchases.”
Brave CEO and co-founder Brendan Eich (who also created the JavaScript programming language) tweeted, “For what it’s worth there’s a setting to disable the autocomplete defaults that add affiliate codes, in brave://settings first page. Current plan is to flip default to off as shown here. You can disable ahead of our release schedule if you want to.

“Good to hear from supporters who’ll enable it.”

Source: Brave Browser Mistake Adds Its Referrer Code For Cryptocurrency Sites – Slashdot

Boffins step into the Li-ion’s den with sodium-ion battery that’s potentially as good as a lithium cousin

Posted on by

scientists in America and China have created a sodium-ion-based battery that can potentially perform at close to the levels of Li-ion, paving the way for a cheaper, commercially viable alternative to lithium.

The key challenge in creating this battery is that sodium-ion cells tend to break down faster than their lithium-ion cousins. Sodium crystals collect on the cathode, made of O3-layered metal oxide, preventing sodium ions from flowing, and thus knackering the operation of the battery.

A solution for this is what the Washington State University-based team – led by Jianming Zheng (Pacific Northwest National Laboratory), Yuehe Lin (WSU), Pengfei Yan (Beijing University of Technology), and Xiaolin Li (Pacific Northwest National Laboratory) – sought to figure out.

They eventually came up with a liquid electrolyte with a high concentration of sodium ions, which prevented the build up of inactive crystals, thus preserving 80 per cent of the cell’s charge capacity after 1,000 cycles.

Not only were the new cells observed as having a higher capacity and better lifespan than older sodium-ion cell designs, but they were able to hit levels closer to those of lithium-ion.

“Our study showed that sodium-ion can be as good as some lithium-ion chemistries and thus make them more competitive and versatile,” The Register was told by Junhua Song, a contributing author to the paper based out of Lawrence Berkeley Labs.

“We are hopeful that a deployable high energy and long cycle life sodium-ion battery can be realised in five years with enough funding resources.”

Song explained that while there could be other advantages to using sodium over lithium other than availability of materials and extraction costs, it is too soon to say that the sodium power cells would be, for example, safer or more environmentally friendly.

“Environmental friendliness relies on many factors because the battery is essentially a complicated system involving more than just electrode materials,” he explained.

“Sodium does provide better environmental benignity due to its resource abundance and accessibility, which might do less harm to the environment during extraction, compared to the geologically constrained lithium counterpart. Similar to environmental friendliness, safety depends on many components (materials, electrolyte, cell architecture, etc), more systematic studies are on the way to tackle the safety aspect of sodium-ion batteries.”

To that end, Song noted that the next steps in development of sodium-ion batteries will involve investigating the cathode and anode materials, and the actual reaction process within the electrolyte.

The team’s paper, “Controlling Surface Phase Transition and Chemical Reactivity of O3-Layered Metal Oxide Cathodes for High-Performance Na-Ion Batteries”, was published in the journal ACS Energy Letters.

Source: Boffins step into the Li-ion’s den with sodium-ion battery that’s potentially as good as a lithium cousin • The Register

Lenovo certifies all desktop and mobile workstations for Linux – and will even upstream driver updates

Posted on by

Lenovo has decided to certify all of its workstations for Linux.

“Our entire portfolio of ThinkStation and ThinkPad P Series workstations will now be certified via both Red Hat Enterprise Linux and Ubuntu LTS – a long-term, enterprise-stability variant of the popular Ubuntu Linux distribution,” said a Tuesday statement from GM and executive director of the company’s workstation and client AI group Rob Herman.

Lenovo is serious about this: the company says its workstations will “offer full end-to-end support – from security patches and updates to better secure and verify hardware drivers, firmware and bios optimizations.” Lenovo will also upstream device drivers into the Linux kernel.

The company’s rationale for the move is that Linux workstations are favourites of a sizable population of power users, especially developers and data scientists. Lenovo wants to relieve their employers of the chore of installing and maintaining Linux on the mildly-exotic hardware such users require. But it’s also tipped a hat to Linux enthusiasts with “a pilot program with a preloaded Fedora image on our ThinkPad P53 and P1 Gen 2 systems; providing the latest pure open source platform for this community-based distribution.” Note, however, that the new arrangements are only for Lenovo workstations. ThinkPads, Yogas and other models will still almost certainly run Linux, but don’t get extra love from Lenovo.

Lenovo’s offering isn’t unique: Dell offers supported RHEL and Ubuntu on its XPS13 and Precision mobile workstations, plus the Precision tower workstations. HP Inc also supports Linux on its Z-series mobile and desktop workstations and claims it was first to do so. Lenovo seems to think it might have them outflanked by supporting all possible configurations of its P-series laptops (The Register counts nine machines in that range) and the seven P-series workstations.

Source: Lenovo certifies all desktop and mobile workstations for Linux – and will even upstream driver updates • The Register

Zoom won’t encrypt free calls because it wants to comply with law enforcement

Posted on by

If you’re a free Zoom user, and waiting for the company to roll out end-to-end encryption for better protection of your calls, you’re out of luck. Free calls won’t be encrypted, and law enforcement will be able to access your information in case of ‘misuse’ of the platform.

Zoom CEO Eric Yuan today said that the video conferencing app’s upcoming end-to-end encryption feature will be available to only paid users. After announcing the company’s financial results for Q1 2020, Yuan said the firm wants to keep this feature away from free users to work with law enforcement in case of the app’s misuse:

Free users, for sure, we don’t want to give that [end-to-end encryption]. Because we also want to work it together with FBI and local law enforcement, in case some people use Zoom for bad purpose.

In the past, platforms with end-to-end encryption, such as WhatsApp, have faced heavy scrutiny in many countries because they were unable to trace the origins of problematic and misleading messages. Zoom likey wants to avoid being in such a position, and wants to comply with local laws to keep operating across the globe.

Alex Stamos, working as a security consultant with Zoom, said it wants to catch repeat offenders for hate speech or child exploitative content by not offering end-to-end encryption t0 free users.

In March, The Intercept published a report stating that the company doesn’t use end-to-end encryption, despite claiming that on its website and security white paper. Later, Zoom apologized and issued a clarification to specify it didn’t provide the feature at that time.

Last month, the company acquired Keybase.io, an encryption-based identity service, to build its end-to-end encryption offering. Yuan said today that the company got a lot of feedback from users on encryption, and it’s working out on executing it. However, he didn’t specify a release date for the feature.

According to the Q1 2020 results, the company grew 169% year-on-year in terms of revenue. Zoom has more than 300 million daily participants attending meetings through the platform.

Source: Zoom won’t encrypt free calls because it wants to comply with law enforcement

GSMA suggests mobile carriers bake contact-tracing into their own apps – if governments ask for it

Posted on by

The GSM Association, the body that represents mobile carriers and influences the development of standards, has suggested its members bake virus contact-tracing functionality into their own bundled software.

The body today popped out a paper [PDF] on contact-tracing apps. After some unremarkable observations about the need for and operations of such apps, plus an explanation of the centralised vs. centralised data storage debate, the paper offers members a section titled: “How the mobile industry can help.”

That section suggests carriers could help to improve the reach of and disseminate such apps with the following three tactics:

  • Integrate software into own apps (e.g. customer self-care app), if this is part of the national strategy
  • Pre-install on devices
  • Communicate to / educate subscribers

The first item may prove unworkable given Google and Apple have indicated they’ll only register coronavirus-related apps if they’re developed by governments and their health agencies. The two tech giants have also said they’ll only allow one app per jurisdiction to use their pro-privacy COVID-19 contact-tracing interface. The second suggestion also has potential pitfalls as contact-tracing apps are generally opt-in affairs. Carriers would need to be sensitive about how they are installed and the user experience offered if the apps ask for registration.

Source: GSMA suggests mobile carriers bake contact-tracing into their own apps – if governments ask for it • The Register

Marketers Bring Antitrust Suit Against Google

Posted on by

Three online advertisers are suing Google for allegedly violating antitrust laws by monopolizing “digital advertising markets.”

“Google leveraged its stranglehold on online search and search advertising to gain an illegal monopoly in brokering display advertising on other companies’ websites,” the marketers allege in a class-action complaint filed last week in U.S. District Court for the Northern District of California. The case was filed on behalf of Washington, D.C. tour company Grand Atlas Tours, Delray Beach, Florida-based Prana Pets (which sells herbs for dogs and cats) and the San Francisco law firm Hanson Law.

They claim Google “achieved this market dominance in part by acquiring rivals in the online advertising space, conditioning access to its search-results data and YouTube video advertising platform upon the purchase of its separate display advertising services, and ensuring those systems were not compatible with those of its competitors in online advertising.”

The complaint comes as the U.S. Department of Justice and a coalition of state attorneys general are reportedly preparing separate antitrust lawsuits against Google.

Grand Atlas Tours and the others allege that Google’s “pervasive monopoly conduct” has resulted in higher prices for advertisers and consumers, lower payments to online publishers and diminished competition in the online ad marketplace.

The complaint alleges both that Google commands a dominant position in search advertising, and that the company has leveraged its market power in search “to drive out competition in the separate market for display advertising services.”

Among other allegations, the marketers claim Google’s decision to eventually block third-party cookies in Chrome will make it “much harder for advertisers and competitors to efficiently bid on ads.”

Google said in January it plans to phase out Chrome’s support for third-party cookies within two years — a move often seen as privacy friendly, because it can prevent companies that have no relationship with consumers from tracking them. Mozilla’s Firefox, as well as Apple’s Safari, already automatically prevent ad-tech companies from using cookies to track people around the web in order to serve them targeted ads.

Source: Marketers Bring Antitrust Suit Against Google 06/02/2020

I’ve been talking about this happening since May 2019 and it’s becoming more and more common

Have I Been Pwned breach report email pwned entire firm’s helldesk ticket system

Posted on by

A hapless IT bod found the Have I Been Pwned service (HIBP) answering its own question in a way he really didn’t want – after a breach report including a SQL string KO’d his company’s helpdesk ticket system.

A pseudonymous blogger posting under the name Matt published a tortured account of what happened when a breach notification email from HIBP was ingested into his firm’s helpdesk ticket system and was automatically assigned a ticket ID.

The company used version 9.4.5 of the GLPi open source helpdesk system, a rather old product but quite functional. As Matt put it: “All was well until we received an email from haveibeenpwned to our helpdesk support address, which automatically got logged as a support ticket.”

When one of your email addresses is included in a breach picked up by HIBP, you can generate a report that tells you where your details were found. Included in the email with the link to the report is the HIBP header logo graphic, partly formed from ASCII text which reads as so:

‘;–have I been pwned?

Problems arose when Matt received that email. While he looked at it and took the relevant actions, GLPi had encountered an issue. “I and the other techs quickly noticed that every single ticket description had been deleted and replaced with partial header data from the HIBP email,” wrote Matt.

This caused some headaches, requiring a restore from the previous day’s backups. Not ideal and quite disruptive.

That evening Matt started fault-finding, eventually narrowing down the ticket-wiping problem to one of either assigning the HIBP email to yourself in GLPi or adding yourself as a “watcher” of it. In both cases, Matt suspected, some kind of SQL injection was happening.

“I managed to shrink the exploit down to six characters (‘;– ” – the space and double-quote at the end appear to be required though this could do with more testing) to achieve the same kind of malicious behaviour, in this case deleting all content of the descriptions for every ticket in the database,” he wrote.

Eventually he figured it out. GLPi 9.4.5 is vulnerable to a SQL injection flaw which just happened to be triggered by the formatting of HIBP’s breach report email. As Matt put it, “GLPI supports HTML emails, which get rendered (almost) normally within the interface. Simply hiding the text in an attribute or the <head> or something will keep it invisible to the tech. You’ve just gotta wait for them to assign it to themselves.”

Buoyed by his success, Matt zoomed off to GLPi’s Github page to find contact details for its maintainers to warn them of the flaw. There he made an equally important discovery: GLPi had since been updated to version 9.4.6. Not only that, but the latest version fixed the SQLi vuln.

“If you’re running GLPI, make sure you’re on the latest release. Or look for alternative software,” he concluded, apparently rather crestfallen from all those excellent but ultimately needless efforts.

Source: Have I Been Pwned breach report email pwned entire firm’s helldesk ticket system • The Register